MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountPHIHealth (basic)HighContained

IMA Diligence Services

bd_ccd420ce52718acd · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 16, 2025

Filed

May 29, 2026

To disclose

23 weeks

Affected

1,977state residents only

Linked

9 filings

Confidence

71%

Full breach record for IMA Diligence Services →3 incidents on file

IMA Diligence Services, LLC reported a ransomware incident affecting 1,977 Washington residents. Unauthorized access occurred between Dec 8-16, 2025, on a legacy third-party server. Data exposed included names, SSNs, driver's licenses, financial accounts, and PHI. The company engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d23 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 8 days

discovery → filing · 23 weeks / 164 days

Dec 8, 2025

Begins

Dec 16, 2025

Discovered

May 29, 2026

Filed

vs. sector median

+4 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_16e5e71a5f4991312026-05-29Verified
Oregon State AGbd_251ec6b205f440ae2026-05-29Verified by operator
New Hampshire State AGbd_3bd537247ac6bc062026-05-29Verified
Vermont State AGbd_4c7e828b895829652026-05-29Verified

Show 4 more filings ↓up to 3d gap

Indiana State AGbd_5cecf8343e66696f2026-05-29Verified
California State AGbd_c997f1d0e86131f52026-05-29Verified
Massachusetts State AGbd_ec7a7a80f0d522ba2026-05-29Candidate
South Carolina State AGbd_8f50a59fb1559a982026-06-01 · +3dVerified

Name: IMA
norm: ima
Domain: imanet.org

Name: IMA Diligence Services
norm: ima diligence
Domain: imadiligence.com
Industry: Professional Servicesllm

Discovered: Dec 16, 2025
Breach occurred: Dec 8, 2025 – Dec 16, 2025
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 29, 2026
Affected individuals: 1,977state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementProviding written notice to relevant state regulators
Initial access: external_remote_services

During the incident: Engaged third-party cybersecurity specialists to conduct an investigation
Notified federal law enforcement
Provided access to credit monitoring services for twelve (12) months through TransUnion
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice to relevant state regulators and the three major credit reporting agencies
Changes made: Implementing additional safeguards and training to its employees
Reviewing policies, procedures and processes related to the storage and access of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(164 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Maine State AGMay 29 · first

Oregon State AGMay 29 · first

New Hampshire State AGMay 29 · first

Vermont State AGMay 29 · first

Indiana State AGMay 29 · first

California State AGMay 29 · first

Massachusetts State AGMay 29 · first

Washington State AGMay 29 · first · this page

South Carolina State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2026
Raw hash: e5fd4a494cedaa05caa54c9ae5ea2c91f88505fe0155a796864acfa72962e3a2

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityIMA

Victim entityIMA Diligence Services

Incidentdiscovered Dec 16, 2025

Stated responseEngaged third-party cybersecurity specialists to conduct an investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com